6 ms·

I can propose a quite straightforward solution for this mess: do not connect things into the Internet. Your thermostat maybe wants to talk with your alarm cloc

I can propose a quite straightforward solution for this mess: do not connect things into the Internet. Your thermostat maybe wants to talk with your alarm clock. I can get that. But it does not have to happen over the Internet. Let them talk locally.

wwwigham 10y ago
That's actually what Bruce wants - and he figures the only way to enforce it is through regulation. He's given up on the sensibilities of individual companies and programmers, and would instead like to rely on regulations to make some basic guarantees. You and I know the basics of computer security. We can take a crack at designing a secure system and maybe do okay. But the argument goes like this: Yes there are security conscous programmers, but there are also many which are not. And those people work on products which make it to market. How do we stop those products from making it to market? Government intervention. He's given up on education and relying on the informed developer, and would rather rely on public policy. I find it a bit sad.
- qwertyuiop924 10y ago
  It also won't work. The only solution to ignorance is education. Having "smart people" make all the decisions will only get you so far.
- jlj 10y ago
  The free market crowd would argue that the surviving companies will bake in the right security if consumers demand it. If companies don't take it seriously, either their customers aren't demanding it, or they will be replaced by companies that do a good job at it. The government has a proven conflict of interest and disincentive to harden the infrastructure. Vulnerabilities are valuable for espionage. And there are already regulations like HIPPA, PCI, etc, yet there are still breaches. Regulation will add complexity to business and will protect market share for the entrenched players who can afford to follow it. That will lead to further consolidation and reduced competition while I feel that the opposite is needed. The fiefdoms described in another post wouldn't be such a bad thing. At the nation state level, competition will also make for better security. Isolationism doesn't work out well in world history. Movement of goods and ideas does a better job at bringing countries together. I feel there's a pendulum swinging back towards isolationism but it goes back and forth over time.
  - alexqgb 10y ago
    What the free-market crowd can never account for - here, or anywhere - is how the market is supposed to resolve issues that are not of direct, immediate interest to self-serving buyers or sellers, but which are of massive and justifiable interest to third parties outside the transaction. Case in point: If a seller in one country can lower the costs of a good shipped to another country by scrapping responsible waste management in favor of polluting the commons (i.e., places where individual property rights claims are difficult to press), then "the magic of the market" is likely to increase - not decrease - the amount of pollution generated by the trade. What libertarians don't like to admit is that they see free markets as more than ideal mechanisms for preserving efficient economies. They also see them as efficient sources of good and just governance. Like all belief systems, faith in the quality of governance supplied by free markets, while rational and well-supported to a point, can be taken to counter productive extremes where it maintenance stops operating like empiricism, and starts to function is ways indistinguishable from fundamentalists religions. Not sure how many sensible knowledgeable people want this to be the dominant force in guiding global network security.
    - CuriousSkeptic 10y ago
      As a nuance though. one could agree with the notion of negative externalities naturally occurring in a free market economy (perhaps in a total laissez faire environment the affected third parties could retaliate in kind though) but disagree with the form of policy to address it. In principle the market should be able to select appropriate fixes if the costs are internalized, but governments have a tendency to focus less on the internalize costs part, and more on selecting fixes. Pragmatically it might be the best way forward, but in principle it goes against free market resource optimizations and instead becomes a gamble that whatever fix is made policy actually do have an impact on the problem, and doesn't make things worse.
      - alexqgb 10y ago
        Pragmatically it might be the best way forward, but in principle it goes against free market resource optimizations This is a pretty good argument the absolute value of principle, tbh For what it's worth, I tend to see principles like map; useful - even indispensable - in many situations, that are nevertheless abstractions and therefor imperfect guides to actual reality. Use maps, yes, but avoid mistaking them - or any system of symbols - for the things they represent (i.e., the map is not the territory). Indeed, principle is a form of proxy wisdom for the young and inexperienced. It's better than nothing, but probably not enough to save you from at least a few episodes of hard reckoning. Assuming these don't get you killed, the places where principle doesn't serve are the ones where mature judgement develops. Granted, there's a point where this doesn't serve either, but that's okay too since mortality always wins in the end.
- hash-set 10y ago
  He's nuts. Elected officials don't get technology. Hillary Clinton had no idea what she was doing with a simple e-mail server. They. Don't. Get. It.
- mreiland 10y ago
  I disagree with the idea that the problem has to do with "non-security minded programmers". Certainly they exist, but the issue more often than not is that security is more expensive than non-security, so companies don't give their developers enough time to actually do security.
rspeer 10y ago
So what's the solution? When other people keep making and buying products that communicate over the Internet, because it's easier, what do you do about it?
- mtgx 10y ago
  If you don't like the "regulations to prevent bad stuff" approach, then use the "we'll let you do whatever you want, but if you screw up you're going to pay dearly to fix it" approach. Then companies can balance the cost of adding a secure enclave and a Grsec kernel (just an example) to their smart coffee maker against having to recall all of their infected products from the market when a botnet takes over them. Besides that stick, I would throw a couple of carrots in there, too, like the companies being able to brag that their products are A+ security rated, etc, in their promotional materials and on their packages.
  - ridgeguy 10y ago
    But the ease of creating companies and abandoning them or otherwise obfuscating their liabilities says that they won't be the ones paying dearly. In short, I think regulations will prevent more damage than post-hoc legal retribution.
    - nickpsecurity 10y ago
      "In short, I think regulations will prevent more damage than post-hoc legal retribution." Time has proven that wrong so far. We got a lot of highly-secure products after DOD's Computer Security Initiative giving clear guidance plus financial incentive. DO-178B and other safety-critical markets are cranking out lots of them on safety side. So is segment of smartcard industry focused on high-security. Regulation works so long as it has effective standards, they're clear, evaluated against product, and must be followed to sell the product. As in TCSEC era and DO-178B, reusable components for common cases show up to reduce the evaluation cost or risk. Open-source security would likely get a boost, too, as companies sponsoring it would sponsor certifiable versions with the higher QA.
trentlott 10y ago
So some hardware maker should propose and publish an open intranetworking guide, ideally. There could be an interesting market for Apple clocks and Apple thermostats, but to increase the likelihood of something like that becoming popular (vs just using the easy Wi-Fi route), wouldn't it taken an unlikely push like that? It will be a long time before manufacturers decide whether or not to put everything online, I think.
- btgeekboy 10y ago
  But why make things compatible with open standards (regardless of who writes them) when you can build an ecosystem?! I say that sarcastically, but it seems to be where the world goes.
shostack 10y ago
Are there any devices that do this? I'd be very much a fan of a local IoT I control, perhaps with an encrypted data file on Dropbox or something it can accees. I have no need for cloud storage from the vendor...I can bring my own.
- robterrell 10y ago
  Isn't this what ZigBee and Z-Wave are for? Local-only wireless network for your things, just bridge out to the internet for services as needed? Instead of making dropbox the nervous system of everything?
- deleted 10y ago
  [deleted]
- eveningcoffee 10y ago
  The whole EIB/KNX standard works like this and has been around for more than 20 years and there are hundreds of devices to choose from. It is designed around local low bound (9600 bps) network where you can connect KNX devices (thermostats, actuators, sensors etc) or gateways/routers to other networks. Only problem it has is that the communication is not encrypted, but being local and isolated, it is not a very big concern. Every other home/building automation systems worked like this recently until some marketing geniuses came up with the IoT campaign.
agumonkey 10y ago
Are there technologies that aim at physical scoping of networks ? Sometimes I joke to myself that IR remotes will be the next privacy graal. Can't hack my RCA TV unless you've been granted access on my couch.
AndrewKemendo 10y ago
do not connect things into the Internet...Let them talk locally. Too simplistic. If devices talk then there will be a way to listen and scale that talking/listening.
boramalper 10y ago
> Let them talk locally. Although I agree, what if one the devices that they communicate locally is connected to the Internet? Then it becomes just another level of indirection...

wwwigham 10y ago

That's actually what Bruce wants - and he figures the only way to enforce it is through regulation. He's given up on the sensibilities of individual companies and programmers, and would instead like to rely on regulations to make some basic guarantees. You and I know the basics of computer security. We can take a crack at designing a secure system and maybe do okay. But the argument goes like this: Yes there are security conscous programmers, but there are also many which are not. And those people work on products which make it to market. How do we stop those products from making it to market? Government intervention. He's given up on education and relying on the informed developer, and would rather rely on public policy. I find it a bit sad.

qwertyuiop924 10y ago
It also won't work. The only solution to ignorance is education. Having "smart people" make all the decisions will only get you so far.
jlj 10y ago
The free market crowd would argue that the surviving companies will bake in the right security if consumers demand it. If companies don't take it seriously, either their customers aren't demanding it, or they will be replaced by companies that do a good job at it. The government has a proven conflict of interest and disincentive to harden the infrastructure. Vulnerabilities are valuable for espionage. And there are already regulations like HIPPA, PCI, etc, yet there are still breaches. Regulation will add complexity to business and will protect market share for the entrenched players who can afford to follow it. That will lead to further consolidation and reduced competition while I feel that the opposite is needed. The fiefdoms described in another post wouldn't be such a bad thing. At the nation state level, competition will also make for better security. Isolationism doesn't work out well in world history. Movement of goods and ideas does a better job at bringing countries together. I feel there's a pendulum swinging back towards isolationism but it goes back and forth over time.
- alexqgb 10y ago
  What the free-market crowd can never account for - here, or anywhere - is how the market is supposed to resolve issues that are not of direct, immediate interest to self-serving buyers or sellers, but which are of massive and justifiable interest to third parties outside the transaction. Case in point: If a seller in one country can lower the costs of a good shipped to another country by scrapping responsible waste management in favor of polluting the commons (i.e., places where individual property rights claims are difficult to press), then "the magic of the market" is likely to increase - not decrease - the amount of pollution generated by the trade. What libertarians don't like to admit is that they see free markets as more than ideal mechanisms for preserving efficient economies. They also see them as efficient sources of good and just governance. Like all belief systems, faith in the quality of governance supplied by free markets, while rational and well-supported to a point, can be taken to counter productive extremes where it maintenance stops operating like empiricism, and starts to function is ways indistinguishable from fundamentalists religions. Not sure how many sensible knowledgeable people want this to be the dominant force in guiding global network security.
  - CuriousSkeptic 10y ago
    As a nuance though. one could agree with the notion of negative externalities naturally occurring in a free market economy (perhaps in a total laissez faire environment the affected third parties could retaliate in kind though) but disagree with the form of policy to address it. In principle the market should be able to select appropriate fixes if the costs are internalized, but governments have a tendency to focus less on the internalize costs part, and more on selecting fixes. Pragmatically it might be the best way forward, but in principle it goes against free market resource optimizations and instead becomes a gamble that whatever fix is made policy actually do have an impact on the problem, and doesn't make things worse.
    - alexqgb 10y ago
      Pragmatically it might be the best way forward, but in principle it goes against free market resource optimizations This is a pretty good argument the absolute value of principle, tbh For what it's worth, I tend to see principles like map; useful - even indispensable - in many situations, that are nevertheless abstractions and therefor imperfect guides to actual reality. Use maps, yes, but avoid mistaking them - or any system of symbols - for the things they represent (i.e., the map is not the territory). Indeed, principle is a form of proxy wisdom for the young and inexperienced. It's better than nothing, but probably not enough to save you from at least a few episodes of hard reckoning. Assuming these don't get you killed, the places where principle doesn't serve are the ones where mature judgement develops. Granted, there's a point where this doesn't serve either, but that's okay too since mortality always wins in the end.
hash-set 10y ago
He's nuts. Elected officials don't get technology. Hillary Clinton had no idea what she was doing with a simple e-mail server. They. Don't. Get. It.
mreiland 10y ago
I disagree with the idea that the problem has to do with "non-security minded programmers". Certainly they exist, but the issue more often than not is that security is more expensive than non-security, so companies don't give their developers enough time to actually do security.

rspeer 10y ago

So what's the solution? When other people keep making and buying products that communicate over the Internet, because it's easier, what do you do about it?

mtgx 10y ago
If you don't like the "regulations to prevent bad stuff" approach, then use the "we'll let you do whatever you want, but if you screw up you're going to pay dearly to fix it" approach. Then companies can balance the cost of adding a secure enclave and a Grsec kernel (just an example) to their smart coffee maker against having to recall all of their infected products from the market when a botnet takes over them. Besides that stick, I would throw a couple of carrots in there, too, like the companies being able to brag that their products are A+ security rated, etc, in their promotional materials and on their packages.
- ridgeguy 10y ago
  But the ease of creating companies and abandoning them or otherwise obfuscating their liabilities says that they won't be the ones paying dearly. In short, I think regulations will prevent more damage than post-hoc legal retribution.
  - nickpsecurity 10y ago
    "In short, I think regulations will prevent more damage than post-hoc legal retribution." Time has proven that wrong so far. We got a lot of highly-secure products after DOD's Computer Security Initiative giving clear guidance plus financial incentive. DO-178B and other safety-critical markets are cranking out lots of them on safety side. So is segment of smartcard industry focused on high-security. Regulation works so long as it has effective standards, they're clear, evaluated against product, and must be followed to sell the product. As in TCSEC era and DO-178B, reusable components for common cases show up to reduce the evaluation cost or risk. Open-source security would likely get a boost, too, as companies sponsoring it would sponsor certifiable versions with the higher QA.

trentlott 10y ago

So some hardware maker should propose and publish an open intranetworking guide, ideally. There could be an interesting market for Apple clocks and Apple thermostats, but to increase the likelihood of something like that becoming popular (vs just using the easy Wi-Fi route), wouldn't it taken an unlikely push like that? It will be a long time before manufacturers decide whether or not to put everything online, I think.

btgeekboy 10y ago
But why make things compatible with open standards (regardless of who writes them) when you can build an ecosystem?! I say that sarcastically, but it seems to be where the world goes.

shostack 10y ago

Are there any devices that do this? I'd be very much a fan of a local IoT I control, perhaps with an encrypted data file on Dropbox or something it can accees. I have no need for cloud storage from the vendor...I can bring my own.

robterrell 10y ago
Isn't this what ZigBee and Z-Wave are for? Local-only wireless network for your things, just bridge out to the internet for services as needed? Instead of making dropbox the nervous system of everything?
deleted 10y ago
[deleted]
eveningcoffee 10y ago
The whole EIB/KNX standard works like this and has been around for more than 20 years and there are hundreds of devices to choose from. It is designed around local low bound (9600 bps) network where you can connect KNX devices (thermostats, actuators, sensors etc) or gateways/routers to other networks. Only problem it has is that the communication is not encrypted, but being local and isolated, it is not a very big concern. Every other home/building automation systems worked like this recently until some marketing geniuses came up with the IoT campaign.

agumonkey 10y ago

Are there technologies that aim at physical scoping of networks ? Sometimes I joke to myself that IR remotes will be the next privacy graal. Can't hack my RCA TV unless you've been granted access on my couch.

AndrewKemendo 10y ago

do not connect things into the Internet...Let them talk locally. Too simplistic. If devices talk then there will be a way to listen and scale that talking/listening.

boramalper 10y ago

> Let them talk locally. Although I agree, what if one the devices that they communicate locally is connected to the Internet? Then it becomes just another level of indirection...